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1. Purpose and Structure of the Document 

This "Updated" version of the April 24th Final Report has been modified from the original version to: a) reflect the 
errata corrige detailed in the final section of this document (section 9); and c) address some inconsequential 
formatting and stylistic improvements that could not be made prior to the official submission date because of the 
limited time available. None of the modifications and improvements contained in this version alter the previously 
reported overall findings. 

Within the context of our engagement with the Central Bank of Cyprus (CBC or Supervisor), Deloitte Financial 
Advisory S.r.l. (Deloitte Italy) is providing this report on the overall credit sector's level of compliance with the AML 
legal framework, to CBC, the Cyprus Ministry of Finance (MoF) and the economie assistance program partners (the 
International Monetary Fund or IMF, the European Central Bank or ECB, and the European Commission or EC). These 
findings are not meant to and do not contain confidential information with respect to any of the six largest Cypriot 
banking institutions covered by this review (each a "Covered Institution") or their customers. 

The remaining content of this document is structured as follows: 

■ Introduction 

■ Executive Summary 

■ Background 

■ Approach 

■ Considerations and Limitations 

■ Sector Level Findings 

- Breakdown of Deposits and Loans 

- Analysis of Sampled Customers 

- Indication of Data Reliability 

- Level of Compliance with the Cyprus Legal Framework 

■ Banking Institution Level Findings 

- Overview 

- Key Findings 

- Breakdown of Deposits and Loans 

- Level of Compliance with the Cyprus Legal Framework 

■ Appendices 

Please refer to Appendix A of this document for a list of common definitions and Appendix B of this document for 
anonymous customer level information reported, as requested, for the each of sample customers of the Covered 
Institutions. 

The report is intended to be read in its entirety; careful consideration should be given to conclusions drawn from any 
one section alone or from a subset of sections of this report, in view of the considerations and limitations set forth in 
Section 6. Finally, the scope of this report is not intended to include recommendations, which are provided separately. 

2. Introduction 

2.1. Confidentiality 

AH documents, data and information the Deloitte Italy team received from CBC or a Covered Institution, including 
documents, data and information pertaining to CBC, any Covered Institution or regulated entity and any 
customer of a Covered Institution or regulated entity, or collected from any Covered Institutions or of which 
Deloitte Italy became aware in the context of its contractual relation with CBC or which are the results of studies, 
tests or research conducted during the engagement for the purposes of execution thereof are confidential. 
Deloitte Italy understands that it is not entitled to provide, publish or disclose such information and data and any 
other confidential information to any third party. 
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Deloitte Italy took steps to safeguard that each team member is bound by confidentiality obligations and signed a 
CBC statement to that extent. AH customer level work was performed on the premises of the respective Covered 
Institutions. 

In addition, as per the terms of the agreement with the CBC, Deloitte Italy complied with the provisions of the 
Cyprus Personal Data (Protection of the Individual) Law 2001 (as amended), the "Data Protection Law", in the 
performance of its activities. 

2.2. Restricted Tender Process 

Deloitte Italy was selected to participate in a restricted tender procedure for the award of the contract for "the 
provision of a CDD review on the Cyprus banking system to be carried out within the framework of the assistance 
program applied for by the Cyprus Government." 

As prescribed in the tender process, the objective of the review was "the assessment of whether CDD 
requirements are effectively implemented by banks in accordance with the Cypriot legal framework, that is, the 
Prevention and Suppression of Money Laundering Activities Laws of 2007-2012 ("AML Law") and the 2008 (CBC) 
Directive to Banks on the prevention of money laundering and terrorist financing ("CBC Directive")." 

The review covered the six largest Cypriot banks at the time of the review, namely, Bank of Cyprus Public Co Ltd, 
Cyprus Popular Bank Public Co Ltd, Hellenic Bank Public Co Ltd, Eurobank Cyprus Ltd, Alpha Bank Cyprus Ltd and 
Russian Commercial Bank (Cyprus) Ltd. 

The contract was awarded by the CBC subject to the agreement of the CBC with the assistance program partners. 

2.3. Terms of Reference 

As part of the invitation to tender received on March 13, 2013 Deloitte Italy was provided with the document 
"Appendix 1 Key Elements for a Third Party AML Audit of the effective Implementation of CDD Measures with 
Regard to Deposits and Loans." Commonly referred to as the "Terms of Reference" or "ToR" for this initiative, 
said document was the basis for the objective, scope, and approach to be followed by Deloitte Italy. The ToR was 
subsequently supplemented to include additional information (e.g., on the specific sampling methodology to be 
followed, on the report format and content, and on the need to also cover transactional activity and suspicious 
activity detection and reporting) and represents the detailed "agreed upon procedures" followed by Deloitte Italy 
in carrying out this engagement. 

Per the ToR, the entire effort together with the delivery of the final report to the CBC, the Cyprus Ministry of 
Finance and the assistance program partners was to be completed within a two week timeframe. 

As consistently indicated throughout the tender process the agreed upon procedures do not necessarily 
represent the scope, approach, and especially the timeframe that Deloitte Italy would have proposed given our 
understanding of the overall objective of this initiative. 

2.4. Independence 

One of the key aspects of the tender procedure was to be able to demonstrate the ability to preserve objectivity 
and independence including by disclosing the details of any existing business relationship with the Cypriot 
government, related agencies, and Covered Institutions. 
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Deloitte Italy is a private firm which is by nature independent and during the years we have developed a series of 
strict internal policies and procedures to help prevent both real and perceived conflicts of interest from arising. 
Accordingly, per our policy, we have performed an internal cross border search for any potential conflicts arising 
between the work to be carried out and the customers we serve; nothing has come to our attention that, in our 
judgment, would have impaired our ability to objectively serve on this engagement. 

The contracting legal entity is Deloitte Italy; as agreed to during the course of the tender process, the Deloitte 
member firm in Cyprus and its practitioners have not been involved, in any capacity, in this engagement. 

In addition, Deloitte Italy agreed for the course of this engagement to manage the financial and investment 
relationships, should any exist, between its partners and members of staff and as applicable partners and 
members of staff of its subcontractors, with the Covered Institutions and/or personal relationships with 
individuals employed by such Covered Institutions. 

3. Executive Summary 

3.1. Overview 

Appreciating the broader context of the economie assistance program for Cyprus in which certain readers might 
approach this report, we have approached its drafting with a view towards providing data and insights that might 
be useful to policymakers seeking to formulate options for the future. Careful consideration should be given to 
the conclusions that can and should be drawn from this report, including the range of limitations on the scope of 
the review under the agreed upon procedures, the limited time period for review and analysis, the limited 
customer sample, and the requested elements to be reported. Deloitte Italy has attempted to apply a rigorous 
and consistent analytical methodology, and to present relevant facts and data while protecting the confidentiality 
of bank and customer information. That notwithstanding, in many cases it would be more prudent to utilize the 
data or reported numbers not as a conclusion with respect to a specific value or degree of compliance or 
omission. The report will likely be more useful to inform the reader as to relative areas of risk and relative 
strengths and weaknesses in relation to efforts to mitigate those risks. When considered together with policy 
priorities, we hope that this might help inform on practical steps where improvements could or should be made, 
as well as the relative costs or tradeoffs involved in such efforts. 

The purpose of this summary section is to attempt to reflect in a balanced and weighted way the general picture 
on the effective implementation of CDD and other measures in the Cypriot banks covered by this review. More 
specifically, following in this section are the high level findings for the analysis of the Breakdown of Deposits and 
Loans as well as for the analysis of the Level of Compliance with the Cyprus Legal Framework. The findings need 
to be measured within the context of the critically important considerations and limitations described in section 6 
of this document. In addition, please note the context of the customer level information in Appendix B, which is 
included in response to the specific requirement to "provide an individual report listing customers in the sample 
(allocating a number by customer in order to preserve confidentiality)" for each Covered Institution. Said 
customer level information is not summarized in this section given its detailed nature. However, the findings in 
the right most columns of Appendix B, which are provided for comparison purposes only, do relate to comments 
found in sections "3.4.1.3. Determination of Customers Subject to Enhanced Due Diligence" and "3.4.1.1. Client 
Acceptance" of this document. 

In considering the findings related to the level of compliance with the CDD requirements of the Cyprus Legal 
Framework, it is worthy of note that these requirements are generally more detailed, and to a certain extent 
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prescriptive, than in many other jurisdictions, including other EU Member States that similarly have implemented 
the requirements of the Third Money Laundering Directive. For example, the enhanced due diligence conducted 
by the Cypriot banks in obtaining passports and verifying addresses of ultimate beneficial owners, including in 
cases involving Politically Exposés Persons (or PEPs) down to a 10% ownership level, is more thorough than the 
EU Standard of 25% ownership. This seems to be a recognition of the unique risks in the jurisdiction, and thus an 
effort to tailor requirements to mitigate those risks. 

The sector level findings with respect to the Breakdown of Deposits and Loans appear to indicate that the Top 
100 borrowers and depositors are prevalently legal persons having Cyprus as the country of residence but that 
their country of origin is Cyprus to a lesser degree and that of the ultimate beneficial owners' country of origin is 
Cyprus to an even lesser degree, with the decrease more evident for deposits than loans. Foreign national 
customers and beneficial owners tend to be from Russia, Greece, the Ukraine, and the British Virgin Islands, 
among other countries. Note that the quantitative data underlying the analysis of the level and breakdown of 
deposits made by and loans granted, which was provided by the six Covered Institutions, appeared to be 
generally reliable, with some inaccuracies noted. 

With respect to the analysis of the Level of Compliance with the Cyprus Legal Framework, the findings indicate 
that from a comparative perspective, certain Covered Institutions appear to fair better than others across most of 
the relevant assessment areas. Bearing in mind the limitations of the sample and of using an un-weighted 
average, aggregating the results across the Covered Institutions appears to indicate a generally solid level of 
compliance with the Cyprus Legal Framework, across the six banks, with a few specific areas requiring further 
attention (e.g., aspects of the Client Acceptance requirements, aspects of the Ongoing Monitoring requirements, 
and aspects of the Reliance on Third Parties requirements). Also at the sector level, the adequacy of the rationale 
for the small number of suspicious activity reports submitted within the retrospective scope of this review is self- 
evident. Lastly, although the framework requirements appear to be sufficiently implemented, the identification 
of unusual transactions and the reporting of suspicious activity to MOKAS appear to be lower than could be 
expected under the Cyprus Legal Framework, whether applying CBC typologies or as compared to practices in 
other jurisdictions. 

3.2. High Level Findings on the Breakdown of Deposits and Loans 

The analysis of the breakdown of deposits made and loans granted to foreign nationals, by country of residence 
and by country of origin, for both customers and beneficial owners is based on information provided by the 
Covered Institutions and subsequently cross-checked with respect to reliability on the basis of our review of key 
information. 

The charts depicting the findings of this analysis, which are found later in the document, use simple un-weighted 
averages to provide aggregate results for the six Covered Institutions. 

The sector level findings with respect to loans show that with respect to the "Top 100" borrowers, 95% are legal 
persons and thus practically the totality of cases, with Cyprus as the country of residence in 70% of cases. The 
country of origin is also Cyprus in 70% of the cases, followed by Russia for 10% of the cases and then Greece, the 
British Virgin Islands, and Serbia. In comparison, for the ultimate beneficial owners of these legal persons the 
country of origin is Cyprus in 50% of the cases, Russia in 20%, and the Ukraine in 5%, followed by the UK, Serbia 
and the Marshal Islands. This trend seems to be generally true whether measured by the count of borrowers or 
the value of the loans. 



4 | P a g e 

This document is strictly confidential and solely for the internal use of personnel of the Central Bank of Cyprus, the Cyprus Ministry of Finance, the 
International Monetary Fund, the European Central Bank, and the European Commission. No part of it may be circulated, quoted, or reproduced for 
distribution to others without prior written approval from Deloitte Financial Advisory S.r.l. 



STRICTLY CONFIDENTIAL - UPDATED FINAL REPORT 

AML Assessment of the Effective Implementation of CDD Measures with Regard to Deposits and Loans 



June 14, 2013 



The sector level findings with respect to deposits show that with respect to the "Top 100" depositors, 90% are 
legal persons, having Cyprus as the country of residence in 40% of cases, followed by the British Virgin Islands in 
25% of cases, Russia at close to 10%, followed by Belize and the Seychelles. In comparison, for the ultimate 
beneficial owners of these legal entities, the country of origin is Russia in 35% of the cases, Cyprus in 25%, 
followed by Greece, the Ukraine, the British Virgin Islands and others. Again, this trend seems to be generally true 
if measured by the count of borrowers or the value of the loans. 

A manual review was performed to validate key information for each Covered Institution. The number of 
incorrect instances of Customer (country of origin, country of residence) and UBO (beneficial owner, country of 
origin, and country of residence) information as compared to the size of each institution's sample was used as a 
proxy for a more comprehensive validation of all of the underlying information used in this analysis. 

The findings of our manual review indicate that for deposits, overall the instances of incorrect information are 
not insignificant and relatively more relevant to customers than to ultimate beneficial owners while for loans, 
that overall the instances of incorrect information are not pervasive and balanced when comparing customer and 
UBO information. Although certain covered institutions fared worse than others, and bearing in mind the 
limitations of this focused validation exercise, generally, the quantitative data underlying the level and 
breakdown of deposits made by and loans granted appears to be reliable. 

3.3. High Level Findings on the Level of Compliance with the Cyprus Legal Framework 
3.3.1. General Takeaways Regarding Compliance with the CDD Requirements 

As a general matter, when reviewing any assessment of compliance with AML requirements, whether at the level 
of a specific financial institution, at a sectoral level, or at a jurisdictional level across multiple regulated sectors, it 
is important to keep in mind that globally recognized AML principles are meant to be preventative and are 
aspirational in nature, and, as such, are constantly evolving to addressing constantly changing areas of risk. The 
practical impact is that in our extensive experience, no institution can be expected to have a 100% perfect 
compliance record. In fact, on the basis of our experience, it is uncommon to find institutions in any jurisdiction 
that achieve 100% compliance across all customers, especially in jurisdictions where the AML legal framework has 
been enhanced relatively recently. Another key component of AML requirements is that they are meant to be 
"risk based" to allow a financial institution to focus on mitigating areas of greatest risk as determined by each 
institution's range of products and services, as well as unique customer base. 

In the review for compliance with the customer due diligence requirements of the Cyprus Legal Framework, it is 
worthy of note that these requirements are more detailed, and to a certain extent more prescriptive, than in 
many other jurisdictions, including other European Union Member States that similarly have implemented the 
requirements of the Third Money Laundering Directive. As shown throughout this report, this level of detail 
appears to reflect in part the recognition by the Cypriot authorities of the unique risks in the jurisdiction, and 
efforts to tailor requirements to mitigate those risks. For example, we noted among the many sub-elements of 
the customer due diligence requirements of the Cyprus Legal Framework that in the case of a bank's reliance on 
third persons, such as professionals or alternative service provider introducers for customer due diligence 
purposes, the bank should promptly obtain and subsequently maintain copies of the document duly certified by 
the third person as a true copy of the original. That said, the review of customer sample files also identified some 
omissions in terms of the file documentation being certified as true copies. Notwithstanding such omissions, the 
customer sample files reviewed consistently contained legible copies of passports and statements of utility bills 



5 | P a g e 

This document is strictly confidential and solely for the internal use of personnel of the Central Bank of Cyprus, the Cyprus Ministry of Finance, the 
International Monetary Fund, the European Central Bank, and the European Commission. No part of it may be circulated, quoted, or reproduced for 
distribution to others without prior written approval from Deloitte Financial Advisory S.r.l. 



STRICTLY CONFIDENTIAL - UPDATED FINAL REPORT 

AML Assessment of the Effective Implementation of CDD Measures with Regard to Deposits and Loans 



June 14, 2013 



used to verify addresses of persons identified to the bank (but unidentified to the public) as ultimate beneficial 
owner, including in cases involving PEPs and/or owners down to a 10% level (below the EU Standard of 25%). 

While detailed requirements can target certain risks, a natural tension exists in that a formalistic approach to 
compliance at the micro level can draw compliance resources and attention away from risks at a more macro 
level. Activity that is rather common in Cyprus as witnessed through the customer sample in terms of a 
combination of high-risk factors including foreign investors, introducing third persons, and cross-border 
transactions, would in many other jurisdictions be quite rare and thus such a customer profile at any given 
financial institution might be the focus of compliance attention as a high-risk outlier. This was not the case with 
respect to the sampled files. 

As per the agreed upon procedures, Deloitte Italy performed an analysis of the overall credit sector's level of 
compliance with the Cypriot Legal Framework on CDD, by aggregating the results obtained from the six Covered 
Institutions, with respect to their 390 sampled customers. 

Bearing in mind the limitations of the sample and thus the ability to extrapolate from it, certain key themes could 
be inferred from the results. From a comparative perspective, certain Covered Institutions appear to fair better 
than others, across most of the relevant assessment areas. Further, some of the Covered Institutions appear to 
have more customers for which assessment areas such as "Reliance on Third Party Introductions", and/or 
"Simplified Due Diligence" (applicable in limited cases), and/or on "Natural Person Not Residing in Cyprus" apply. 
Most importantly, and again bearing in mind the limitations of the sample and further of using an un-weighted 
average, aggregating the results across the Covered Institutions appears to indicate a generally solid level of 
compliance across the six banks with the following areas requiring further attention: (1) Client Acceptance 
(certain key aspects such as Customer Business/Economie Profile and others), (2) Ongoing Monitoring, and (3) 
Reliance on Third Parties. Within this context we noted as a credit sector level general trend that more recently 
established dient relationship appeared to have more complete due diligence files than accounts opened a 
number of years prior and especially before 2008. 

Please refer to the "Institution Level" section of this document for further findings for each of the Covered 
Institutions as these are too detailed and specific to be summarized here. 

3.3.1.1. Client Acceptance 

Generally, the Covered Institutions do not seem to have a suitable degree of accuracy in gathering 
and documenting relevant information from customers in order to understand the purpose of the 
account, to define the customer's business economie profile and to evaluate the expected pattern 
and level of transactions (examples of required information observed missing from or insufficiently 
detailed in customer files include: too generic descriptions of customer's business activity and 
purpose of opening the account, documentation regarding the expected origin of incoming funds and 
the expected destination of outgoing transfers and payments, and the customer's source and size of 
wealth and annual income). 

This missing or insufficiently detailed documentation is primarily evident in accounts, which 
represent a large part of the sample, that have been established for passive investments and 
apparent tax minimization purposes as distinct from operating entities (e.g., the incorporation 
documents provide for the investment powers, perhaps with limited geographical or sectorial 
specialization, and target investment values). 

6 | P a g e 

This document is strictly confidential and solely for the internal use of personnel of the Central Bank of Cyprus, the Cyprus Ministry of Finance, the 
International Monetary Fund, the European Central Bank, and the European Commission. No part of it may be circulated, quoted, or reproduced for 
distribution to others without prior written approval from Deloitte Financial Advisory S.r.l. 



STRICTLY CONFIDENTIAL - UPDATED FINAL REPORT 

AML Assessment of the Effective Implementation of CDD Measures with Regard to Deposits and Loans 



June 14, 2013 



The timing of customer identification was at times inadequate as there seemed to be a practice of 
collecting information and documentation after the business relationship was established, reportedly 
because of perceived familiarity with the customer. 

Procedures adopted by the Covered Institutions in order to identify the UBO via reliance on third 
parties showed some weaknesses (e.g., at times the UBO is identified through a non-certified 
declaration; the control chain between customer and the UBO is not always easily traceable, etc). 

Covered Institutions were generally not considering as a higher risk factor the nature of offshore 
exposure, as well as multi-layered and less transparent ownership and control structures for their 
legal person customers. 

3.3.1.2. Ongoing Due Diligence - Updating Information Throughout the Business Relationship 

Periodic monitoring and verification of customer and UBO identity are performed on a "risk based" 
approach and according to each Covered Institution's specific internal policy (e.g., yearly for high risk 
customers; every 3-5 years for normal/medium customers; over 5 years for low risk customers). Even 
in cases where a foreign customer's business was brought to the bank through an introducer and the 
customer due diligence carried out via third persons, in some cases the bank would subsequently 
arrange an in-person meeting with the ultimate beneficial owner. Nevertheless, within a customer's 
file (with specific reference to high risk customers), even where there were summary forms or 
customer transaction statement showing updates, there has been observed a general lack of 
traceability of controls performed (for example, specific customer review forms and/or 
documentation/proof of information obtained over time). 

3.3.1.3. Determination of Customers Subject to Enhanced Due Diligence 

The Covered Institutions have generally adopted procedures in order to determine whether a 
customer/UBO is a PEP and/or is involved in bribery, corruption or other financial crime, or otherwise 
requires enhanced due diligence, including regular checks of commercially available databases or the 
Internet, upon account opening. Those controls were generally not consistently/programmatically 
performed during the course of the business relationship, on a risk based approach, according to 
each institution's specific internal policy. As such, the Covered Institutions appeared exposed to the 
risk of not promptly identifying and managing a change in a customer's status (e.g., customers/UBOs 
who subsequent to account opening have been identified through commercially available sources as 
becoming a PEP or having negative indications with respect to money laundering and/or other 
financial crime activities). 

3.3.1.4. Reliance on Third Parties 

In general, third parties or persons that play an important role in the onboarding CDD process (e.g., a 
business introducer, shareholding nominee, secretary, or director) have been observed in a number 
of cases to be interconnected with one another through ownership relations so as to weaken the 
premise that Covered Institutions can reasonably rely on third parties as an independent source; this 
is particularly the case in multi-layered and less transparent ownership and control structures. 

The Covered Institutions may rely on third parties for updating customer due diligence information, 
such as through certifications and verifications, but the Covered Institutions appear to have been 
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overly reliant on third persons in providing such information in the absence of risk based verification 
of the underlying information provided, in particular in multi-layered and less transparent ownership 
and control structures involving foreign jurisdictions, which are generally considered to be of higher 
money laundering risk. 

More guidance on appropriate practices for the banks vis-a-vis not only such third parties based in 
Cyprus, but also in other jurisdictions might promote more consistent compliance in this area. 

3.3.2. Other General Takeaways 

3.3.2.1. Tax Optimization - Generation of Alerts 

Many of the files in the customer sample could be interpreted as evidencing account relationships 
established either primarily or in significant part driven by tax considerations. As a general matter, 
the customer files do not provide information as to the tax implications of the customer relationships 
or transactions, but often evidence services provided to the customer by accountants, lawyers and 
company service providers. 

As part of the review for potential unusual or suspicious transactions related to the customer sample, 
many of the transactions alerts generated through the application of Standard AML compliance 
methodologies (in particular, as related to transfers of large, round number values or a wire transfer 
in to an account followed by wire transfer out to a related party) upon review appeared to be in 
connection with investment activities. However, this should be considered within the context of the 
only very recent addition in the FATF standards (February 2012) of serious tax crimes constituting a 
predicate offence for money laundering and as far as Cyprus is concerned, a relevant amendment of 
the law only very recently enacted (December 2012). 

Where the documentation was generally consistent with the transactions (e.g., the file indicated a 
loan agreement as the basis for the outgoing principal and the subsequent repayments with interest) 
no determination was made related to potentially unusual or suspicious activities unless information 
was omitted from the file or the document was significantly incomplete or otherwise inconsistent 
with the activity. 

3.3.2.2. Complexity of Legal Persons / Intermediary Beneficial Owner Structures 

The results of a targeted analysis conducted to assess the complexity of intermediary beneficial 
ownership structures, which is based on a subset of the sampled customers, across all the Covered 
Institutions, and not only in relation to higher risk customers, should be viewed in the context of the 
very detailed requirements of the Cyprus Legal Framework (not required or applied in most other 
jurisdictions) possibly reflecting the intent of the Cyprus authorities to mitigate the enhanced risks 
related to such phenomena. 

The complex structures observed are characterized by the presence of nominee shareholders, on 
average three levels or layers of intermediary beneficial owners, four or more individuals involved in 
the ownership structure and an average of three countries of residence or incorporation. 

For the most part, the complex structure observed in the sample did not have the UBO identified 
through original independent sources but rather through certified declarations by third parties, 
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which at times were not certified. Briefly, whereas UBOs identities were almost always verified 
through certified true copies by an independent source (e.g., a Passport) the intermediate and 
ultimate beneficial owners in an ownership structure were typically not verified via original 
documents from independent sources (e.g., certificates of official registry from a foreign country 
such as of incorporation or incumbency). 

3.3.3. Level of Compliance by Key Elements to Assess the Adequacy of Transaction Monitoring Procedures and 
Suspicious Activity Reporting 

The AML review uncovered a number of transactions at each of the Covered Institutions that were 
viewed as unusual or suspicious, when independently applying factors including the customer profile 
and the AML transaction typologies identified by CBC. The uncovered transactions resulted from 
both a manual review of account activity as compared to customer profiles and a programmatic 
review of transactional data, for each of the customers in the selected sample. 

The Deloitte transaction monitoring rules adopted were selected on the basis of their alignment with 
the specific requirements of the agreed upon procedures and were programmatically run against the 
electronic data gathered. This generated 10,173 alerts to be investigated, from a sample of 570.000 
transactions. Said alerts as well as other potentially unusual activity stemming from the manual 
review were investigated by the project teams and either cleared as not representing unusual activity 
or warranting further investigation. Deloitte identified 536 instances of potentially suspicious activity 
that required further investigation, out of which 29 appeared to be potentially suspicious. Said 
potentially suspicious activity is contained in the main body of this report and has been referred to 
the CBC to determine if reporting to MOKAS is warranted. 

Caution should be taken in relying on these numeric findings. In some cases, with more time 
available, further investigation, including in some cases obtaining additional information from the 
customer, could have led to determine that the transaction or activity had a reasonable explanation 
and was not suspicious. Conversely, with more time available additional transaction monitoring rules 
could have been run and most likely would have produced more alerts and more potentially 
suspicious activity to be investigated and reported. 

A general finding nevertheless can be made that at the sector level the identification of unusual 
transactions and the reporting of suspicious activity to MOKAS appears to be lower than could be 
expected under the Cyprus Legal Framework and specifically in applying the CBC typologies, as well 
as compared to practices in other jurisdictions. 
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